Lookup the Tailnet Lock feature.
A feature in the client software they control, that you run as root, that auto-updates regularly?
A feature in the client software they control, that you run as root, that auto-updates regularly?